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‘The Legislative Audit Committee 
of the Montana State Legislature: 


This is our performance audit of Childhood Immunization Requirements managed 
by the Public Health and Safety Division of the Department of Public Health and 


Humans Services. 


This report provides the Legislature information about the immunization requirements 
for attendance at child care facilities, preschools, and elementary schools as well as the 


use of Montana’s immunization registry, imMTrax. 


This report includes recommendations to ensure immunization compliance at all 
preschools, and to more actively monitor immunization compliance at child care 
facilities and elementary schools. Additionally, it includes recommendations addressing 
data quality protection, guidance for use of imMTrax, and aligning Montana’s 


immunization requirements with current standards of care. 


A written response from the department is included at the end of the report. We 
wish to express our appreciation to department personnel for their cooperation and 
assistance during the audit. 


Respectfully submitted, 
// Tori Hunthausen 


Tori Hunthausen, CPA 
Legislative Auditor 


Room 160 ¢ State Capitol Building * PO Box 201705 * Helena, MT * 59620-1705 
Phone (406) 444-3122 * FAX (406) 444-9784 * E-Mail lad@mt.gov 
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13P-07 REPORT SUMMARY 


Montana is currently and historically ranked among the lowest states for the 
immunization coverage rate for children 19-35 months old. Montana’s young 
children could be better protected against vaccine preventable diseases by 
aligning state immunization requirements with Centers for Disease Control 
and Prevention recommendations, monitoring preschool immunization 
activity, improving verification and reporting of immunization records for 
schools, and providing more statutory guidance for the use of the state’s 





immunization registry. 





Context 


The Montana Immunization Program is part 
of the Communicable Disease Control and 
Prevention Bureau within the Public Health 
and Safety Division of the Department 
of Public Health and Human _ Services 
(department). Most of its $3 million annual 
budget is funded from federal sources. The 
Immunization Program has 10 FTE and 
affects in some way every child in every county 
of the state through the immunizations they 
and their contemporaries receive. Montana 
has a population of nearly 61,000 children 
under the age of 5. There are an additional 
11,700 kindergartners and more than 66,000 
elementary school attendees that are most 
directly affected by state immunization 
requirements. 


Historically, Montana has ranked either last-or 
among the lowest-of the states in immunization 
coverage for 19-35 month old children. 


In Montana, there are lists of age-appropriate 
immunizations that generally all children must 
receive prior to attending a Montana child 
care, preschool, and school located in state law 
and administrative rule. This audit focused 
on determining if the department effectively 
enforces child care facility, preschool, 
and elementary school compliance with 
immunization requirements. 


Results 


Audit work found that Montana’s existing 
immunization requirements for various 
facilities do not align with current standards 
of care for immunizations to protect against 
vaccine preventable diseases. 


We also found no monitoring of preschool 
immunization requirement compliance by 
the department, except for preschools that 
are run in combination with a licensed or 
registered child care. 


Audit work identified that while the 
department does monitor child care facility 
compliance with immunization requirements, 
improvements could be made to better ensure 
children in these settings are protected 
against vaccine preventable diseases. These 
include following up with children reported 
as noncompliant with requirements and 
changing the selection process of child care 
facilities for assessment. 


While the department annually collects data 
from schools regarding the immunization 
status of their students, we found 
improvements could be made such as more 
consistent compilation and verification of 


(continued on back) 


S-1 


data submitted by the schools to better 
protect elementary school attendees. 


This audit also focused on the efficient and 


effective use of Montana’s Immunization 
Registry (imMTrax), which is designed to 
make immunization requirement tracking 
and related activities more efficient and 
effective through centralized data storage and 
access. We identified several issues affecting 
the use of imMTrax, including a lack of 
statutory guidance regarding the sharing of 
information within the system, and the need 
for improved controls to ensure data within 
the system is accurate and reliable. 


Recommendation Concurrence 


Concur 


Source: Agency audit response included in 
final report. 





For a complete copy of the report (13P-07) or for further information, contact the 
Legislative Audit Division at 406-444-3122; e-mail to lad@mt.gov; or check the web site at 


http://leg.mt.gov/audit 





Report Fraud, Waste, and Abuse to the Legislative Auditor's FRAUD HOTLINE 
Call toll-free 1-800-222-4446, or e-mail ladhotline@mt.gov. 





Chapter | — Introduction 


Introduction 


Protecting the public against vaccine preventable diseases is a well-established role for 
the Department of Public Health and Human Services (department). A long standing 
foundation of this effort is the required immunization of children against certain 
diseases prior to their attendance at child care, preschool, and school. 


The Montana Immunization Program is part of the Communicable Disease Control 
and Prevention Bureau within the Public Health and Safety Division. Most of its 
$3 million annual budget is funded from two federal sources; they are the Vaccines 
for Children (VFC) program and Section 317 of the Public Health Service Act. VFC 
provides vaccines at no cost to children who might not otherwise be vaccinated because 
of inability to pay. Section 317 is administered by the Centers for Disease Control and 
Prevention (CDC) and provides grants to states for vaccine purchase, outreach, and 
disease surveillance programs. The Immunization Program has 10 FTE and affects in 
some way every child in every county of the state through the immunizations they and 


their contemporaries receive. 


A goal identified in the Public Health and Safety Division’s current Strategic Plan is 
to, “Enforce public health laws and regulations and promote and protect health.” One 
strategy identified to reach this goal is, “Enforce public health laws and regulations 
including. ..immunization requirements and ensuring valid medical exemptions to 


immunization requirements.” 


Montana Immunization Coverage Low Among States 


The CDC sets the childhood immunization schedule based on recommendations from 
the Advisory Committee on Immunization Practices (ACIP)—a group of medical 
and public health experts. This schedule is adopted by the American Academy of 
Pediatrics and the American Academy of Family Physicians. To develop comprehensive 
recommendations for each vaccine, ACIP works throughout the year, reviewing 


available data on new and existing vaccines. 


In 2013, the ACIP recommended schedule included immunization against 14 harmful 
and potentially deadly diseases through a series of more than 30 different shots between 
birth and age 6. The diseases this immunization schedule protects against includes 
chicken pox, diphtheria, Haemophilus influenzae type b, Hepatitis A, Hepatitis B, 
influenza, measles, mumps, pertussis, pneumococcus, polio, rotavirus, rubella, and 
tetanus. See Appendix A for more details on the diseases, immunizations, and time 


frames recommended for the immunizations. 
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In order to gauge the public’s protection against some of these vaccine preventable 
diseases, the CDC measures the percentage of individuals in the country that have 
received the ACIP recommended immunizations. The CDC uses a random survey of 
the parents and guardians of 19- to 35-month-olds regarding their child’s immunization 
status, which is then verified with the child’s health care provider. Montana currently 
ranks among the lower states in this “immunization coverage rate” for 19-35 month 
old children. In 2012 there were approximately 18,000 children in this age group in 
the state. Historically, Montana has ranked either last-or among the lowest-of the 
states in immunization coverage for this group but Montana’s ranking has improved. 
In 2011, Montana’s coverage rate was 59.6 percent and the state ranked 47 of the 
49 states reporting. In 2012, Montana’s rate increased to 66.5 percent and our ranking 
moved to 35 of the 50 states reporting. This change is reflected in the following maps, 
which show state immunization coverage rates for children 19-35 months old for 2011 
and 2012. 


Figure 1 


State Immunization Coverage Rates for Children 19-35 Months Old 
2011 
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* No Data Available for South Dakota 


State Immunization Coverage Rates for Children 19-35 Months Old 
2012 
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Source: Compiled by the Legislative Audit Division from Centers for Disease 
Control and Prevention’s records. 





Vaccine preventable diseases are not common in this country but do persist around 
the world and outbreaks can occur in the United States. For example, there have been 
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outbreaks of pertussis in various parts of Montana for the past three years. In 2011, 
the CDC reported 222 cases of measles in the United States, the highest number in 
15 years. Because of these kinds of risks, public health experts stress that immunization 
coverage should be increased to prevent the resurgence of vaccine preventable diseases. 


The public health concerns regarding nonimmunized children go beyond the facilities 
they attend. In addition to the direct protection of individuals who are vaccinated, 
vaccines also protect the community by decreasing the spread of infectious agents. 
For diseases spread through person-to-person contact, a high level of immunization 
in a community may disrupt the transmission of disease, thus protecting those who 
have not been immunized or who did not respond to the immunization. This indirect 
protection is called “herd immunity.” 


Audit Objectives and Scope 


The Legislative Audit Committee prioritized a childhood immunizations performance 
audit for fiscal year 2013. Based on our initial audit assessment of the immunization 
program activities, we developed two audit objectives. To determine if the department: 


1. Effectively enforces child care facility, preschool, and elementary school 
compliance with existing immunization requirements. 


2. Has controls in place to ensure efficient and effective use of Montana’s 
immunization registry (imMTrax) in order to protect public health and 
safety. 


Those at greatest risk for missing an immunization are children younger than 
age 6, when the majority of immunizations are recommended to occur. Therefore, 
our assessment focused on children’s immunizations, specifically from birth to the 
beginning of school. The data reviewed in the audit is from calendar years 2010-2013. 


Audit Methodologies 


To address our objectives, we conducted the following audit work: 
¢ — Interviewed staff at the department, local health departments, and schools. 
¢ Interviewed staff of other state immunization programs. 


¢ Reviewed survey response data of local health department staff. Of 
53 possible respondents, 42 (79 percent) survey recipients initiated the 
survey, and 36 (68 percent) finished the entire survey. 


¢ — Reviewed immunization compliance data of child care facilities and schools. 
¢ — Reviewed processes of the immunization registry (imMTrax). 


¢ Reviewed contracts and deliverables between the department and local 
health departments. 


¢ — Reviewed the school reporting system. 


¢ Reviewed federal and state laws and rules related to immunizations. 


Area for Further Study 


The CDC indicates that a significant barrier to achieving a more fully immunized 
population is the lack of dependable and centralized records. Consequently, all states 
are working toward achieving a complete immunization registry. Montana’s imMTrax 
is a confidential, population based system used to collect, consolidate, and maintain 
vaccination data in one location, which is designed to make immunization requirement 
tracking and related activities easier because all of the data will be in one location. ‘The 
immunization program is working toward a fully functional and complete registry but 


challenges remain. 


These challenges, discussed in more detail in Chapter VI, include data completeness, 
data validation, and other issues. Further study in this area, such as an Information 
Systems Audit of the imMTrax system, could fully evaluate the extent of these 
challenges and make recommendations to assist the department in addressing them. 


Report Contents 


The remainder of the report provides additional background; presents audit findings 


and conclusions; and makes recommendations in the following areas: 
¢ Chapter IT provides program background. 


¢ Chapter III considers Montana’s required immunizations and preschool 
enforcement. 


¢ Chapter IV examines the role of the department and of local health 
departments in enforcing the immunization of children in child care. 


¢ Chapter V analyzes how children in school are protected against vaccine 
preventable diseases through enforcement by the department. 


¢ Chapter VI considers the effective and efficient use of the department’s 
immunization registry, imM Trax. 


Chapter II - Background 


Continuation of Immunization Coverage Protects 
Montana Children and General Public 


State immunization programs depend on the Centers for Disease Control and 
Prevention’s (CDC) setting of the childhood immunization recommendations via 
the medical experts on the Advisory Committee on Immunization Practices (ACIP). 
States then have varying approaches to adopting the recommendations. In Montana, 
there are lists of age-appropriate immunizations that generally all children must receive 
prior to attending a Montana child care, preschool, and school located in state law 
and rule. Child care immunization requirements are in the Administrative Rules of 
Montana (ARM) 37.95.140. Preschool requirements are also in rule, ARM 37.114.704. 
School requirements are in state law, §20-5-403, MCA. 


These requirements are part of a continuation of immunization coverage designed to 
protect young children in child care, preschool, and school from vaccine preventable 
diseases. Figure 2 (on page 8) illustrates this continuation of coverage by showing the 
different environments in which children spend their time, immunization requirements 
from the ACIP, and the entities that have reporting or oversight roles regarding the 
immunization of Montana’s young children. More information regarding specific 
immunizations are found in Appendix A. 
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Figure 2 
Continuation of Immunization Coverage 
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Source: Compiled by the Legislative Audit Division from Centers for Disease Control and Prevention and 
department records. 





This continuation protects the general public health as well because it reinforces 
existing herd immunity by reducing the number of nonvaccinated individuals in a 
community, thereby making the spread of disease more difficult. 


Department of Public Health and Human 
Services Oversight Responsibilities 


‘There are ramifications for noncompliance with these requirements. If documentation 
of a child’s age-appropriate immunizations is not provided, the child is to be excluded, 
meaning they should not be allowed to attend the child care, preschool, or school until 
the requirements are met. Ifa pupil is excluded from school, the Department of Public 
Health and Human Services (department) or the local health department may seek 
an injunction requiring the parent, guardian, or responsible adult to present evidence 
to the school the pupil has been immunized, take action to fully immunize the pupil 
against the diseases, or file for an exemption. Any person not complying with these 
immunization requirements can be subject to an up to $500 civil penalty. While the 
department is not responsible for exclusion of pupils, the department does have a role 


in ensuring immunization requirements are met and the public is protected against 


vaccine preventable diseases. 


The department works with local partners to make sure children have received the 
age-appropriate immunizations prior to attending a Montana child care or school. 
There are two processes in place designed to accomplish this. 


The department contracts with local health departments to conduct site visits of child 
care facilities in their local jurisdictions to determine if all the attendees’ immunization 
records are present and up-to-date. In Montana, one local health department is 
generally located in each county, although six counties in central Montana have 
joined together to create a combined health department, and there are several joint 
county and city health departments across the state. Local health department staff 
interact directly with members of the community through their clinics and provide 
feedback to the department on numerous topics. They submit quarterly reports to 
the immunization program regarding child care facilities they have assessed and the 
immunization status of the attendees. Similarly, the department depends on schools 
to report on the immunization status of their pupils. Schools submit reports to the 


immunization program once a year. 


Unless an organization is attached to a child care, there is currently no monitoring of 
preschool attendees. This is discussed further in Chapter III. 


Attendee Immunization Status Options 


When reporting on the immunization status of a child, there are five general categories. 

“Excluded” means the child is not attending because they have not had the required 

immunizations. In contrast, “up-to-date,” means the child has received all of the state- 

required immunizations for their age and institution. The three remaining categories, 
defined below, also allow the child to continue attending the institution. 

¢ Conditionally attending: A child having at least the first shot of each series 

required for their age and institution, as well as a documented “catch-up 

plan,” which will bring them up-to-date within a certain time, signed by a 

medical professional, is allowed to attend the institution. An example would 


include a child that has missed two doses in a series. It may not be medically 
advisable for that child to catch-up in a short time frame. 





¢ Medical exemption: In some cases, it may not be medically advisable for 
a child to receive all the immunizations generally required for their age 
group. Documentation signed by a medical professional indicating the 
contraindication is required. 





¢ Religious exemption: If the parents/guardians of a child attending school 


are religiously opposed to immunizations, they may submit their request 
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for an exemption annually. This exemption is not permitted for child care 
or preschool except for one immunization required of child care attendees, 
Haemophilus influenzae type b. 


While the department depends on schools and local health departments to submit 
the information, the department has a role in to ensuring the state’s laws protecting 
children against vaccine preventable diseases are properly enforced. 


Registry Designed to Make Immunization 
Tracking More Efficient 


Montana’s “imMTrax” is a confidential, population based system used to collect, 
consolidate, and maintain the vaccination data of Montanans in one location. ‘The 
system is designed to make immunization requirement tracking and related activities 
more efficient and effective through centralized data storage and access. 


A record for every child born in the state is created through a transfer of information 
from the state’s electronic birth records system. Immunization data is then added 
to the child’s record by health care providers. This can include general contact 
information like name, address and phone number; parent/guardian; and primary 
health care provider. Over time, as the child receives more immunizations, additional 
information is then added to the child’s record such as immunization type and date 
received, contraindications for any vaccines, and other health information relevant to 
immunizations. New information can be added directly by a health care provider or 
through an electronic transfer of information. 


The registry is currently used by some health care providers as a resource to check on 
the immunization status of patients. It is also used by some local health department 
staff to check the immunization status of children at the child care facilities they are 
assessing as part of their responsibilities in their contract with the department. 


In Montana, individuals may choose not to have their, or their child’s, immunization 
information included in imMTrax. The imMTrax system is discussed in more detail 


in Chapter VI. 


Chapter III - Required Immunizations 
and Preschool Compliance 


Introduction 


The Department of Public Health and Human Services (department) requires potential 
attendees of facilities where numerous people are present to receive immunizations 


against certain diseases prior to attending. 


This chapter addresses our first audit objective to determine if the department effectively 
enforces child care, preschool, and school compliance with existing immunization 
requirements. Our audit work showed that Montana's existing immunization 
requirements do not align with current Standards of Care related to immunizations for 
protection against vaccine preventable diseases. We also found limited monitoring and 
enforcement at preschools by the department. The remainder of this chapter discusses 


these findings. 


Montana Immunization Requirements 
Less Than Experts Recommend 


The annual childhood immunization schedule recommended by the Centers for 
Disease Control and Prevention’s (CDC) Advisory Committee on Immunization 
Practices (ACIP) is put together by a group of medical and public health experts 
that have reviewed the available data on new and existing vaccines. This schedule 
is adopted by the American Academy of Pediatrics and the American Academy of 
Family Physicians. The Montana Vaccine for Children Program, a federally funded 
effort providing vaccines at no cost to children who might not otherwise be vaccinated 
because of inability to pay, also lists ACIP recommendations as the standard 
practice for immunization coverage and generally requires providers to follow ACIP 
recommendations. Section 2-18-704(8)(b)(ii), MCA, specifically identifies the ACIP 
recommendations as the immunizations that must be covered in state employee 
insurance plans. Also, §33-30-1014 (2)(b), MCA, identifies ACIP recommendations 
as the immunizations that must be covered by disability insurance plans offered by 
health service corporations in the state. 


In 2013, the schedule included immunizations against 14 harmful and potentially 
deadly diseases through a series of more than 30 different shots between birth and 
age 6. 


Montana requirements in state law and rule do not currently include all of the ACIP 


recommended immunizations. They also do not include all of the immunizations 
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schools. Areas of concern are highlighted in blue. 


Table 1 





measured by the CDC in coverage rates for 19- to 35-month-olds. Table 1 illustrates 
these differences by comparing the ACIP immunization recommendations and 
immunization requirements for attendance at Montana child care, preschool and 


Current Vaccination Recommendations and Montana’s Vaccination Requirements 








Immunization 


Included in ACIP 
Recommendation 


Required for 
Attendance in 
Montana Licensed/ 
Registered Child Care 
(ARM 37.95.140) 


Required for 
Attendance in 
Montana Preschool 
(ARM 37.114.704) 


Required for 
Attendance in 
Montana School 
(§20-5-403, MCA) 





DTaP to protect 
against diphtheria, 
tetanus, and pertussis 


Yes 


Yes 


*Yes 





IPV to protect against 
polio 


Yes 


Yes 


Yes 





MMR to protect 
against measles, 
mumps, and rubella 


Yes 


Yes 


Yes 





Hib to protect against 
Hemophilus influenza 
type b 


Yes 





Hepatitis B to protect 
against the disease 


Yes 


No 





Varicella to protect 
against chicken pox 


Yes 


No 





PCV to protect against 
pneumococcus 


Yes 


No 


No 





Influenza to protect 
against the disease 


Yes 


No 


No 


No 





Hepatitis A to protect 
against the disease 


Yes 


No 


No 


No 





RV to protect against 
rotavirus 








Yes 





NO 





NO 





No 





Source: Compiled by the Legislative Audit Division from Centers for Disease Control and Prevention and 
department records. 


* Section 20-5-403, MCA, does not require pertussis vaccination for children 7 years of age or older. 


** Not recommended by the ACIP in children older than 5. 
*** Not recommended by the ACIP in children older than 8 months. 





Other states more closely follow the ACIP recommendations and require immunizations 
against diseases Montana currently does not. For example, Montana is among only: 


¢ 3 states not requiring varicella immunization for kindergarten entrance. 


* 6 states not requiring Hepatitis B immunization for kindergarten entrance. 


¢ — 11 states not requiring Hepatitis B immunization for child care attendees. 





¢ 17 states not requiring the PCV-Pneumococcal Conjugate immunization for 
child care attendees. 


States have varying mechanisms for adopting ACIP recommendations and tailoring 
them for their immunization programs; some making it easier to more quickly respond 
to changes made by the ACIP. In Idaho, the Board of Health and Welfare adopts the 
rules for their immunization program, which includes new required immunizations. 
In Wisconsin, the Secretary of the Department of Health Services has the authority to 
add required vaccinations to that state’s list of requirements. 


In Montana the current process for updating required vaccinations involves changing 
a rule or law. Because the legislative environment is more geared to long term and 
comprehensive policy making, changing state laws related to required immunizations 
is generally not seen as an effective approach for reviewing the intricacies of new 
vaccines and their potential public health benefits. However, the department has not 
attempted to update the kindergarten vaccine requirements for many years. 


The rules related to required immunizations have not been updated in more than four 
years, and some laws related to immunizations have not been updated in more than 
30 years. Montana’s immunization lists have the potential to become significantly out 
of date in relationship to the national recommendations, which in turn, are largely 
how rankings of immunization coverage are determined. Meaning a child could be 
up-to-date according to Montana rule and law but still bring Montana's immunization 
coverage rate down because they are not up-to-date according to the instrument the 
CDC uses to measure coverage. 


More importantly, out-of-date immunization requirements increase the public health 
tisk. The absence of CDC/ACIP recommendations on the state’s required lists of 
immunizations prevents the department from having the authority to require those 
shots, and with every year that passes, Montana’s children are at a greater risk of not 
receiving the immunizations experts have determined are necessary best practices to 


protect their own and the general public’s health. 
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RECOMMENDATION #1 





We recommend the Department of Public Health and Human Services: 


A. Propose rule changes and seek legislation to align Montana’s child care, 
preschool, and school immunization requirements with the Advisory 
Committee on Immunization Practices recommendations. 


w 


Establish a process to regularly determine if changes are needed to 
immunization requirements. 


TO 


Preschool Immunization Compliance 


Montana law and rule define preschools, list the specific immunizations required 
for preschool attendance, require the immunization status of preschool attendees be 
reported to the department, and detail the processes for conditionally attending or 
obtaining a medical exemption for preschool attendees. 


The department currently does not monitor immunization requirement compliance 
at Montana's preschools. An exception is when the preschool is run in combination 
with a licensed or registered child care, the compliance of the preschool attendees will 
be enforced in conjunction with the child care. The lack of monitoring of preschools 
is not only contrary to rule and statutory requirements but also creates a deficiency 
in Montana’s continuation of immunization coverage, which is designed to protect 


children attending facilities where numerous people are present. 


Other states have more complete continuation of immunization coverage. In Idaho, in 
addition to child care and school immunization enforcement, the immunization status 
of attendees in preschool is monitored. It is similar to how the state monitors their pupils 
in kindergarten through grade 12. Parents/guardians must provide documentation of 
current age appropriate immunization status to the preschool they wish their child to 
attend. If the documentation is not presented, or it is not up-to-date, the child will 
not be allowed to attend the preschool. Exceptions are allowed for medical or religious 
exemptions and children with conditional attendance plans. 


Preschool Attendee Population Unknown 


The department indicates its focus on child care immunization requirements in 
Montana developed largely because the immunization program offered to assist with 
the immunization aspect of the already existing efforts of the department’s licensing 
bureau in regulating child care facilities. However, there is no such structure currently 


for preschool regulation. They are neither licensed nor monitored. Consequently, the 
department is unable to determine how many preschools independent of child care 
facilities exist in the state, which hampers its ability to determine what kind of resources 
would be necessary to begin enforcing the immunization compliance of preschools. 
The department indicates preschool immunization is an area they should be looking at 
and states that the main task would be identifying the preschools, and then they could 
add preschools to its current child care assessment process. 


The lack of data about preschools makes it impossible to directly report how many 
children are affected. More general numbers are available, and can help us understand 
the magnitude of the issue. According to the U.S. Census Bureau in 2012, there 
were approximately 61,000 children under age 5 in the state. The 2012 Kids Count 
report indicates there were about 20,000 licensed and registered child care slots, 
indicating that 41,000 or about two-thirds of Montana children under age 5 were 
in an environment that had no immunization requirement protections. Interpolation 
of this data with 2012 kids count report data regarding preschool and kindergarten 
enrollment estimates a preschool population in the state of 4,300-7,600. 


State law provides that the governing authority of any school, including preschools, 
has enforcement authority to prohibit attendance of pupils who have failed to obtain 
required immunizations. It also provides the department the authority to track and 
enforce school, including preschool, compliance with immunization requirements. 
The local and state health departments are to have access to all information relating 
to immunization of any pupil in any school. If a pupil is excluded from school, the 
department or the local health department may seek an injunction requiring the 
parent, guardian, or responsible adult to present evidence to the school that the pupil 
has been immunized, take action to fully immunize the pupil against the diseases, or 
file for an exemption. 


While the department is not responsible for exclusion of pupils, it is the department’s 
responsibility to make sure the children attending preschools are protected against 
vaccine preventable diseases. Children without immunizations are a potential health 
threat to their classmates, younger siblings, others who have not been immunized, and 


the general public. 


The department has a variety of steps it can take to begin the process of monitoring 
preschools, including: 


¢ Gathering data regarding preschools from local health departments. 
¢ — Collecting information about preschools from schools. 


¢ Researching business licenses with “preschool” in the business name. 
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RECOMMENDATION #2 





We recommend the Department of Public Health and Human Services 
develop and implement a documented process to ensure preschool attendee 
compliance with immunization requirements. 


TO 


Chapter IV — Protecting Child Care Attendees 


Introduction 


Child care facilities are among those entities at which Montana law and rule 
require attendees be vaccinated against certain diseases. This chapter addresses our 
first audit objective to determine if the Department of Public Health and Human 
Services (department) effectively enforces child care facility compliance with existing 
immunization requirements. Audit work found that controls to ensure consistency 
related to child care assessments could be improved, as could controls designed to 
ensure follow up with children being reported as either noncompliant or conditionally 
attending. In addition, controls regarding the selection of child care facilities for 
annual assessment do not currently ensure all facilities are assessed on a regular basis. 
The remainder of this chapter discusses these findings. 


Child Care Attendees Must Meet 
Immunization Requirements 


Table 2 provides information by age group on Montana’s population from birth to 
age 5 and the facilities they might attend which have immunization requirements. 


Table 2 


Population of Montana Children Birth to Age 5 and Facilities 


Their Age Group Might Attend 
2012 





Potential Facilities with Continuation of Immunization 


ae Nails Immunization Requirements Coverage 





Under 3 years 35,807 Child Care 





Approximately 60,862 children 
under age 5 and 20,000 Licensed 
Child Care or Registered Day Care Slots 
Preschool with immunization requirements. 
Preschool estimate 4,300-7,600. 


3 and 4 years 25,055 





Immunization requirements are 
mandatory to start kindergarten, 
which generally begins when the 
child is age 5. 


5 years 12,889 Elementary School 




















Source: Legislative Audit Division interpolation from U.S. Census, Kids Count Report, and 
department records. 
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The department is required by state law to adopt rules for the protection of children 
in child care from various health hazards, including communicable diseases. 
Administrative rules require children receive certain age appropriate immunizations 
prior to attending child care. This rule also requires a child be immediately excluded 
from attendance at a child care if they are not vaccinated and do not have a record of 
medical exemption or conditional enrollment. A religious exemption is available for 
one immunization required of child care attendees, Haemophilus influenzae type b, 
but not for others. Responsibility regarding exclusions varies within the department 
depending on the size of the child care. Based on department policy, the exclusion 
of a child from a smaller (12 or fewer attendees) family or group child care facility is 
the responsibility of the licensing bureau of the Quality Assurance Division, while 
exclusions at larger (13 or more attendees) child care centers is the responsibility of 
the local health departments based on a contract they have with the immunization 
program. 


As discussed in Chapter I, the department contracts with local health departments to 
conduct site visits of child care facilities in their local jurisdictions to determine if all 
the attendees’ immunization records are present and up-to-date. The exact expectations 
of the local health departments related to these tasks are documented in what most 
refer to as an Immunization Action Plan (IAP) contract between the immunization 


program and the local health departments. 


Among the expectations of the IAP contract are quarterly reports containing data 
related to the attendees of the child care facilities that were assessed. These reports 
include spaces for local health department staff to indicate the number of children 
that do not have up-to-date immunization records, meaning they are noncompliant 
with the requirements; have no immunization records, which is also noncompliant; or 
are conditionally attending, which means the child does not have all of the required 
immunizations but is on an established plan to receive them in a certain time frame 


and in the meantime can attend the child care. 


Child Care Assessment Inconsistencies 


Our survey of local health department staff regarding IAP contract related activities 
identified inconsistencies among local health departments regarding how IAP contracts 
are implemented. Examples include inconsistencies regarding whether respondents felt 
they had the authority to exclude children from a child care for noncompliance. Other 
inconsistencies identified through survey work include: 

¢ Inconsistencies in the process and length of time provided to a child care 


center to have an individual child come into compliance with immunization 
requirements. Department policy states the center has 14 days after being 


notified of the noncompliance. Many responses included contacting the 
parents or child care center weekly to see if the paperwork has been received 
at the center. However, others were unspecified such as “each situation is 
managed on a case-by-case basis.” 


¢ Inconsistencies in the process local health departments report using for 
interacting with a child care that is not in compliance with immunization 
requirements, such as no immunization files, or files indicating incomplete 
immunizations for the child’s age. Of the 36 local health department 
staff who answered the question related to their process for interacting 
with a child care in noncompliance, 5 responded that this is generally not 
a problem, 4 stated they would let the state know of the noncompliance, 
and 4 mentioned conditional attendance forms being put in place while 
compliance is achieved. There appears to be an emphasis on education rather 
than exclusion of the children not in compliance, which is required after 
14 days. 


A review of IAP quarterly reports indicates the possibility of varying levels of protection 
against vaccine preventable diseases provided to child care attendees and the general 
public. One local jurisdiction may be very strict, while the next lax. 


A review of IAP quarterly reports from a sample of five counties indicate there are child 
care reports which include children listed as not in compliance with the immunization 
requirements rule and some which do not. Because there is no documented follow-up 
for children not in compliance, it is not possible for the department to determine if this 
is because a local health department made sure all attendees at the child care facilities 
they assess are in compliance before reporting, or whether all were children compliant 
for the sample period. Figure 3 (on page 20) shows the child care immunization 
compliance rates of Montana counties in 2012. 
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Figure 3 


Child Care Immunization Rate by County 
2012 





less than 85% 
| 85% to 90% 
- 90.01% to 95% 


greater than 95% 


Data not available for counties in white 


Source: Compiled by the Legislative Audit Division from department records. 


Follow-up Needed for Child Care Attendees not in 
Compliance With Immunization Requirements 








In 2012, department records indicate of the 15,320 children whose records were 
assessed, 1,397 children (9.1 percent) were identified as either not having up-to-date 
records, having no immunization record, or conditionally attending. The department 
indicates that while it depends on the local health departments to follow up on these 
children, there is no requirement in the IAP contracts that they do so or that they 
document how or whether these children come into compliance with the immunization 
requirements. 


Additionally, the department is unable to know if exclusions are occurring as they 
should because there is no documented, systematic follow up with local health 
departments regarding attendees that are reported as noncompliant. Children may be 
attending child care without the required immunizations, putting other attendees as 
well as the general public at risk for vaccine-preventable diseases. 


a 


RECOMMENDATION #3 





We recommend the Department of Public Health and Human Services: 


A. Expand contract provisions with the local health departments to follow 
up on children reported as noncompliant or conditionally attending. 


B. Follow up with local health departments to ensure exclusions occur in 
compliance with immunization requirements. 


TL 


Child Care Assessment Selection 
Process Could Be Improved 


The IAP contract requires local health departments to annually assess 80 percent of 
the licensed child care centers (13 or more attendees) in their jurisdiction. For example 
in 2012 in Yellowstone County, there were 36 child care centers identified; the local 
health department was required to assess 80 percent of the centers or 29. The local 
health department currently may select any 29 of the 36 centers to assess to meet this 


threshold. 


Local health departments with 10 or fewer licensed centers in their jurisdiction, 
must assess all of the centers, as well as 80 percent of family and group child care 
(12 or fewer attendees) facilities. For example in 2012 in Lincoln County, there was 
1 child care center identified as well as 11 family and group child care facilities. The 
local health department was required to assess the 1 center as well as 9 (80 percent) of 
the family and group facilities. Again, the local health department currently may select 
any 9 of the 11 centers to meet this requirement. 


Consequently, a local health department could consistently select the same child care 
facilities to assess every year, meaning another group of child care facilities in their 
jurisdiction would not be routinely assessed. This creates a situation where children 
could be attending a child care facility that has never been assessed for immunization 
compliance by the Immunization Program. 


In addition, the requirement is related to the number of child care facilities, not the 
number of children. Especially in those counties with many larger child care centers, 
the possibility of the local health department consistently choosing child care facilities 
with smaller enrollment numbers to assess creates a situation where large numbers 
of children could be attending a child care center that has never been assessed for 


immunization compliance by the Immunization Program. 
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We identified specific child care facilities that according to Immunization Program 
records appeared not to have been assessed by the local health department in two 
consecutive years. The IAP contract language regarding this topic was developed as a 
way for the department to establish an assessment threshold but not require 100 percent 
of the child care facilities be assessed annually. The department feels 100 percent 
would not be realistic compared to the small amount of funding the program is able to 
provide to the local health departments. 


While we understand the department’s position on requiring 100 percent of child 
care facilities be reviewed, we believe the department could better ensure child care 
facilities are consistently reviewed. For example, the department could keep its current 
80 percent requirement and add a requirement that each facility be reviewed within an 
established time frame. 


Ne 


RECOMMENDATION #4 





We recommend the Department of Public Health and Human Services 
strengthen its annual child care assessment selection process to ensure all 
facilities are consistently assessed. 


Chapter V — Protecting Elementary 
School Attendees 


Introduction 


Montana’s continuation of immunization coverage is designed to protect children and 
the general public against vaccine preventable illnesses by ensuring attendees at various 
facilities, including schools, are in compliance with immunization requirements. State 
law and rule require kindergartners be vaccinated against certain diseases prior to 
entering elementary school. 


This chapter addresses part of our first audit objective regarding whether the 
Department of Public Health and Human Services (department) effectively enforces 
school compliance with existing immunization requirements. Audit work found 
that improvements could be made to better ensure elementary school immunization 
compliance. The remainder of this chapter discusses these findings. 


Department Collects Data Regarding School 
Compliance With Immunization Requirements 


According to Montana’s Office of Public Instruction (OPI), during the 2012-2013 
school year, there were 11,708 kindergartners in Montana. Enrollment in first 
through sixth grade was 66,256. Since elementary school students routinely come 
into contact with pupils in grades other than their own, including kindergartners, 
nearly 78,000 children are directly affected by kindergarten entry immunization 
requirements. The importance of herd immunity is heightened because school 
attendance is generally mandatory. 


Section 20-5-403, MCA, states the governing authority of a school may not allow 
a person to attend as a pupil unless the pupil has been immunized against various 
diseases, qualifies for conditional attendance, or files for an exemption. In addition, 
state law and rules require schools to: 


¢ — File a report on the immunization status of all pupils under its jurisdiction 
with the department and the local health department. 


¢ — Have all information relating to immunization of any pupil in any school 
available for access by the department and the local health department. 


If a pupil is excluded from school, the department or the local health department 
may seek an injunction requiring the parent, guardian, or responsible adult to present 
evidence to the school that the pupil has been immunized, take action to fully 
immunize the pupil against the diseases, or file for an exemption. 
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While the department is not responsible for exclusion of pupils, the department does 
have a role in ensuring immunization requirements are met and the public is protected 
against vaccine preventable diseases. Additionally, as established in ARM 37.114.720, 
the department is responsible for collecting the Annual School Immunization 
Survey data used by the Centers for Disease Control and Prevention (CDC) to assess 
vaccination coverage for communities and identifying groups of children that may 
lack connections to the primary care system. The CDC requires information about 
kindergarten and 7th grade students; the Montana program collects information 
regarding pupils in all grades K-12. 


The Department Conducts the Annual 
School Immunization Survey 


Schools currently submit information to the department regarding the immunization 
status of their pupils via a web based reporting site. This information includes the 
number of students per grade at the school, those pupils without immunization 
records, those with exemptions, and those conditionally attending. They also collect 
information regarding each required shot. The audit focused on the requirements 
for kindergarten entrance. The department’s goal is to get the information from 
all schools, including public, private, and nonaccredited schools. The department 
currently begins this process by obtaining a list of all accredited public schools from 
OPI. This list usually includes more than 850 schools. The department then adds 
private and nonaccredited schools to the list based on information it has received from 
these schools during previous year’s submissions. 


The department contacts the schools on its list early in the school year to remind 
them of the required reports. If the schools have not reported by the December Ist 
deadline, the department sends two more reminders in order to get a response from the 
nonreporting schools. After collecting the data each year from schools, the department 
reports this data to the CDC. In addition, the department compiles aggregate and 
regional data and provides the data to all the schools and local health departments. 


Audit Work Identified Inconsistencies in 

Annual School Immunization Survey 

As part of our audit work, we reviewed the data compiled by the department based on 
school reports for 2010 through 2012 and identified: 


¢ The department does not independently verify the accuracy of the data 
submitted by the school. 


¢ — Inconsistencies occurred in the names of schools from year to year. 


¢ — Inconsistencies occurred in which schools reported from year to year. For 
example, one school reported data in 2010 and 2012, but not in 2011. 


¢ — For the schools that did not report, based on department records, we could 
not identify the number of pupils enrolled in the school. 


The school reporting form includes spaces for recording the number of children with 
no immunization records, conditionally attending, or exemptions. Table 3 illustrates 
the number of kindergarten students in each of these categories reported during the 
2012-2013 school year. 


Table 3 


Kindergartners Reported in Various 
Immunization Status Categories 


2012-2013 School Year 





No Immunization Conditionally Medical Religious 
Record Attending Exemption Exemption 


1 14 67 235 























Source: Compiled by the Legislative Audit Division from 
department records. 





However, with no data from nonreporting schools, it is not possible to determine the 
immunization rate for Montana kindergartners as a whole and whether additional 
students would be assigned these categories. 


Formalized Policy and Procedures 
Regarding School Data Are Needed 


While the department has implemented a new electronic reporting system for schools 
to more effectively report immunization data, we did not identify formalized policy 
and procedures regarding how department staff should collect, compile, and report 
school data. 


While the department reports the immunization survey response rate of schools 
turning in information regarding their pupils in the 2012-2013 school year was 
approximately 96 percent, based on our audit work, it is difficult to ascertain what the 
96 percent reflects. The exact list of schools, which would serve as denominator in any 
percentage calculation, is not readily identifiable from program records. Additionally, 
the department does not have a process in place to further analyze school report data 
to determine the validity of the school’s reported numbers. 


Diminished management information makes data-based decision-making difficult, 
and resources cannot be effectively directed based on need. Additionally, if the 
department is not aware of pupils without up-to-date immunization records, the 
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department is unable to determine whether exclusions are occurring as they should. 
Meaning, children may be in school without the required immunizations, putting 
other attendees as well as the general public, at risk for vaccine preventable diseases. 


According to the CDC, school entry surveys should reflect an accurate picture of 
immunization levels of children entering school. In other states we contacted, schools 
also selfreport immunization information but some have a process to independently 
verify the information. For example, North Dakota tests a sample of data received in 
their school reports against the data in the state’s immunization registry. While the 
department may be able to validate records for some pupils using Montana’s registry, 
other tools such as OPI’s enrollment numbers are also available. 


When discussing these concerns with department staff, the department stated it 
depends on the schools or the local health departments to follow up on children 
not reported or reported as having no immunization record. While the department 
depends on schools to submit the information, it is the department’s responsibility 
to ensure the state’s laws protecting children against vaccine preventable diseases are 
properly enforced. 


ee 


RECOMMENDATION #5 





We recommend the Department of Public Health and Human Services: 


A. Develop formalized policy and procedures regarding the compilation and 
verification of school reports. 


B. Develop a documented process to actively monitor school attendee 
compliance with immunization requirements. 


TT 


Department Should Monitor Pupils’ 
Conditional Enrollment Requirements 


Montana Administrative Rule 37.114.721 requires schools to notify the department 
and the local health department if a student has been excluded for failing to meet 
the requirements of conditional enrollment. This means if a student does not receive 
the required immunizations in the time frame agreed to when they were allowed to 
continue attending school, the school is to exclude them and notify the department 
and the local health department. The report must include the child’s name, address, 
parent or responsible adult, and the day of the exclusion. 


Through our audit work, we found the department has not developed policy or 
procedures to follow up with students who are conditionally attending, or track 
excluded students. Additionally, the department has not communicated this 
notification requirement to schools. 


In interviews with local school officials responsible for reporting immunization 
information to the department, we found that, while rare, school exclusions for 
immunization noncompliance have occurred. The department does not currently 
track this information, so it has no record of exclusions, and there is also no way to 
determine how many of the exclusions are the result of failing to meet the requirements 
of conditional enrollment. 


Since the department is unaware of whether schools have excluded and/or should be 
excluding pupils who do not meet conditional enrollment requirements, children may 
be in school without the required immunizations, putting other attendees, as well as 
the general public, at risk for vaccine preventable diseases. 


Ne 


RECOMMENDATION #6 





We recommend the Department of Public Health and Human Services 
develop a documented process to: 


A. Notify schools about the requirements of ARM 37.114.721. 


B. Track students excluded for failing to meet the requirements of a 
conditional enrollment. 
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Chapter VI — Montana’s Immunization 
Registry, “imMTrax” 


Introduction 


The Centers for Disease Control and Prevention (CDC) indicate that a significant 
barrier to achieving a more fully immunized population is the lack of dependable and 
centralized immunization records. Consequently Montana, and all other states, are 
working toward achieving a complete and fully functional immunization registry for 
their states’ populations. Immunization registries are designed to make immunization 
requirement tracking and related activities more efficient and effective through 
centralized data storage and access. The annual costs of the registry in Montana is 
approximately $200,000 in federal funds. 


This chapter addresses our second audit objective to determine if the Department 
of Public Health and Humans Services (department) has controls in place to ensure 
efficient and effective use of Montana’s Immunization Registry (imMTrax) in order to 
protect public health and safety. Our audit work identified several issues affecting use of 
the system, including a lack of statutory guidance regarding the sharing of information 
within imM Trax, and the need for improved controls to ensure data within the system 
is accurate and reliable. The remainder of this chapter discusses these findings. 


How the Immunization Registry Works 


In Montana’s registry, imMTrax, a record for every child born in the state is created 
through a transfer of information from the state’s Vital Statistics Information 
management system. Immunization data is then added to the child’s record by health 
care providers. This can include general contact information like name, address and 
phone number; parent or guardian; and primary health care provider. Over time as the 
child receives more immunizations, additional information is then added to the child’s 
record such as immunization type and date received, contraindications for any vaccines 
and other health information relevant to immunizations. This kind of information 
is covered by Health Insurance Portability and Accountability Act (HIPAA) privacy 
protections. 


A child born in Montana generally receives their first dose of the Hepatitis B vaccine 
before leaving the hospital when they are born. The immunization registry system is 
set up so that after the birth record is filed, information such as name, date of birth, 
sex, and data regarding their first dose of the Hepatitis B vaccine is transferred to 
imMTrax. The child is then recommended to have another Hepatitis B dose within 
their first two months of life. This immunization might occur at their one month 


CO ESS 


29 


30 





Montana Legislative Audit Division 


checkup with their pediatrician. The registry is designed so the pediatrician should 
be able to pull up the child’s record in imMTrax and see the date the child received 
their first dose of Hepatitis B and if there were any complications. The pediatrician can 
then record the second dose of Hepatitis B for the child. For the child’s two month 
checkup, there are four recommended vaccines. If the child sees a doctor other than 
their usual pediatrician for this checkup, imMTrax is designed to allow the other 
doctor to pull up the child’s record and determine which shots they have received and 
which ones are due. The registry is intended to record all of the information related to 
this child and all of the vaccines received regardless of where in the state they receive 


the immunizations. 


Public Health Benefits of Sharing Immunization Data 


In 2013 the recommended schedule of immunizations included a series of more 
than 30 different shots between birth and age 6 to protect against 14 diseases. The 
registry can help health care providers navigate this complicated matrix and determine 
when a patient is due for a vaccine and also prevent too many vaccines from being 
administered to a child. It is used by some local health department staff to check the 
immunization status of children at the child care facilities they are assessing. In addition 
to these health care benefits, in our increasingly mobile society, this single location for 
immunization data can be beneficial for parents needing to present documentation of 
their children’s immunization for entrance to kindergarten or child care. Also, local 
health department staff can use the registry to determine the risk of their county’s 
population if an outbreak of a vaccine preventable disease occurs. Using the registry, 
they are able to see how many people in their county are not vaccinated against that 
particular disease, and plan accordingly. 


Statutory Guidance for Immunization Registry Use 


The efficient and effective use of immunization registries depends on a number of 
factors. For example, the CDC indicates that data in a successful registry should be 
complete. So it is essential that as many children as possible be included in the registry 
and as many of their immunizations as possible be recorded. States utilize various 
approaches to increase the completeness of their registry data. For example in North 
Dakota and Arizona, state law requires health care providers to enter immunization 
data into their registry; it is voluntary in Montana. In Oregon state law provides 
guidance on definitions of authorized users of their registry and gives an example of 
a “potential catastrophic disease threat” which allows emergency use of data in the 
registry by some users. 


Another example of statutory guidance that is given in other states relates to individual 
participation in the registry. There are two models states can choose for individual 


participation in a state immunization registry like imMTrax. The first is “opt-out.” 
This means any person who does not want to have their immunization information 
included in the registry must request to “opt-out” of it. Contrasted to an “opt-in” 
state, meaning before any individual’s immunization information is submitted to the 
registry, the health care provider must secure the person’s signature to “opt-in.” There 
are 44 states with opt-out systems, and six including Montana with opt-in systems. 


Opt-In Requirements Affect Data Completeness 


Our survey of local health department staff regarding their use of the registry indicated 
that of the 27 individuals responding to a question regarding what affects their use 
of the registry, 14, or 52 percent, said opt-in requirements. Local health department 
staff can be affected by opt-in requirements in two ways. Survey respondents noted 
that opt-in requirements reduce the usefulness of the registry when they are unable to 
check on the immunization status of one of their new patients, or a child in a child 
care they are assessing, because a previous health care provider had not gotten consent 
from the child’s parents to include the information in the registry. 


The second way opt-in requirements affect local health departments is the extra time 
that is required to secure consent. The concern is that because of time constraints, 
a health care provider may not give a parent that opportunity, which keeps useful 
information that otherwise would have been included out of the registry. While many 
choose to include their child’s information in the registry, there are some that do not. 
In opt-out systems, there remains an avenue for this to occur. 


Department management also indicated that opt-in requirements reduce the efficient 
and effective use of the registry. The lack of information that otherwise would be 
included in imMTrax, except for time constraints on a health care provider, presents 
public health concerns because data in the registry is not complete. Our survey 
of local health department staff regarding their use of the registry indicated of 
36 individuals responding to a question regarding whether using imMTrax increases 
their organization’s immunization coverage rate, 28 (77 percent) said yes. Local health 
department staff indicated that the registry allows them to more efficiently assess a 
child’s immunization status because all of the data is one place. However, this capacity 
is diminished because the data is not complete because information is being kept out 
of the registry because of opt-in requirements. 


The department currently operates the imMTrax system under its broad statutory 
authority to protect and promote public health, which includes preventing the spread 
of communicable diseases. However, there is no specific statutory guidance regarding 
use of the registry or information sharing between health care professionals and other 
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system users. The type of guidance that could be addressed in state law would include 


the following: 
¢ — Identification or definition of required or optional system users. 
¢ Circumstances where opt-in or opt-out requirements should apply. 
¢ — Control over personal health information and access to records. 
¢ Information sharing between the department and other public health entities. 


¢ Departmental reporting responsibilities. 


During the 2013 Legislative Session, legislation was introduced to change Montana 
to an opt-out state related to imMTrax, but the bill did not advance past an initial 
committee hearing. Given the lack of statutory directive on the issues discussed above, 
the department’s ability to efficiently and effectively implement and maintain imMTrax 
has been affected. As a result, it is unclear whether the full public health benefits of 
the registry are being realized or whether the state’s initial and ongoing monetary 
investment of $200,000 annually in federal money is cost-effective. The CDC has 
encouraged the development of registries and some aspects of the VFC program 
requires the use of a registry; the use of registries is likely to increase due to the current 
view of the CDC. Seeking legislation to provide guidance on use of the immunization 
registry would allow the department to begin addressing data completeness and other 


issues. 
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RECOMMENDATION #7 





We recommend the Department of Public Health and Human Services seek 
legislation providing guidance on the use of the state’s immunization registry. 


To 


Data Quality Controls Could Be Improved 


To test imMTrax controls we first reviewed the data input processes and quality control 
measures applied to those processes. These specific controls play a fundamental role in 
the quality of data in the system. The quality of the data, in turn, plays a fundamental 
role in the ability of the registry to be effectively and efficiently used. 


Our audit work found the quality of the data in imMTrax was a concern that affected 
the efficient and effective use of imMTrax by health care providers and others. Issues 
include multiple records of a single child, immunizations indicated as “not valid,” 
when it appears they are valid, and submitted data not appearing in the system in a 
timely manner. In addition, common reports produced from immunization registry 


data include “recall,” which are generated to identify patients who are behind on 
immunizations; “reminder,” which identifies those who will be due for immunizations 
soon; “vaccine usage,” which lists patients, immunizations given, etc., for a particular 
time frame, and “invalid shots,” which list patients who have received invalid 


immunizations due to interval constraints or age inappropriateness. 


There is little usefulness in reports like these to protect public health and safety if 
they are based on unreliable, incomplete, or voluntary data; it reduces the likelihood 
of effective and efficient use of the registry. Data quality concerns raise public health 
issues too. Any child that does not have up-to-date immunizations poses a potential 
public health risk, especially to their younger siblings and others who have not been 


immunized. 


System Documentation Could Be More Complete 


Figure 4 (on page 34) illustrates how data flows into Montana’s immunization registry. 
There are currently three ways data is put into the registry: transfer of data through 
interfaces, manual entry, and upload of flat files or batch files through scripts. Manual 
entry occurs at the provider level where immunizations are given. Data regarding the 
child’s name, types of immunizations received, dates immunizations received, etc. is 
directly entered into the imMTrax system by staff at the practice, clinic, or hospital. In 
contrast, the transfer of data through interfaces occurs when a health care provider has 
electronic health records which are set up to “talk” directly to the imMTrax system and 
eliminates the need for health providers to enter information regarding immunizations 
into both their electronic record system and imMTrax. ‘The third process occurs when 
a provider has data that, rather than directly “interfacing” with the imMTrax system, 
sends a batch or flat file to the department. Script language is then run on the files 
to upload the data so it can be incorporated into the imMTrax system. There are 
processes that validate the data before entering the imMTrax system. 


33 


34 


Montana Legislative Audit Division 


Figure 4 
Processes and Validations Used to Input Data on imMTrax 





Electronic 
Health Record 
Interface 


Various Validation imMTrax 
Manual Entry Processes Database 


Flat Files or 
Batch Files 


Source: Compiled by the Legislative Audit Division. 





The processes for which documentation regarding data validation exists are indicated 
in blue (manual entry) and those that do not are in purple (various validations). The 
department does not have mappings of these processes including data flow between 
the systems. Additionally, the department does not have complete documentation 
regarding the validations applied to data for each software application. 


Best practices recommend the documentation of information systems because it helps 
organizational personnel understand the implementation and operation of security 
controls associated with information systems. Specific guidance related to system 
documentation controls indicates that information system documentation should 
describe secure configuration, installation, and operation of the system; effective use 
and maintenance of security functions and mechanisms; and known vulnerabilities 


regarding configuration and use of administrative and privileged functions. 


Best practices observe the inability to obtain needed documentation may occur due to 
the age of the information system or lack of support from developers and contractors. 
Our audit work found instances of both of these in relation to imMTrax. ‘The staff 
working directly with this system have been with the program for less than 18 months. 
Their understandable lack of institutional knowledge compounds the issue of no 
system documentation regarding data validations. The staff working on the system 
have gathered some understanding from user manuals and what has been informally 
passed on to them, but little has been formally documented. Additionally, we found the 
contractor responsible for some of the data validations does not have readily accessible 
documentation regarding how validations are applied in specific applications. 


While best practices indicate documentation should be recreated if it is essential to the 
effective operation of controls, the department is unable to understand the validation 


points of data due to no formal documentation of data flow. Therefore neither 
department staff, nor we, could determine what controls were applied to immunization 
data prior to the data being put into imMTrax. This lack of documentation created an 
inability to test the validation points and therefore we could not obtain assurance over 
the data quality of the system. 
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RECOMMENDATION #8 


We recommend the Department of Public Health and Human Services: 


A. Develop written procedures and mappings for data flow into the 
immunization registry. 


B. Determine what validations are applied to the data and document the 
findings. 


Privileged User Roles Should Be Restricted 


One way the quality of data in an information system can be protected is by restricting 
access based on roles. Roles are created for various job functions and varying levels of 
access to the system are granted based on the business need of those roles. Specifically, 
best practices indicate the following controls related to role assignment. 

¢ The organization should employ the principle of least privilege, allowing only 


authorized access for users which are necessary to accomplish assigned tasks 
in accordance with organizational missions and business functions. 


¢ ‘The organization should restrict privileged accounts on the information 
system to organization defined personnel or roles. 


¢ The organization should require users of information system roles, with access 
to security functions or security relevant information, use nonprivileged 
accounts or roles when accessing nonsecurity functions. 


During our audit, we found that 34 users of imMTrax were assigned “administrative 
user” status. These specific individuals can make changes to the data including adding 
data to tables, assigning roles to other users, and deleting previously recorded vaccines. 
Based on our review, 17 of these individuals were contractor users, 12 were department 
staff, and five more related to the department for specific functions. While this level of 
access was assigned to department and contractor personnel to allow them to perform 
certain aspects of their job, not all department staff require this kind of elevated access. 
This situation results in multiple users with the ability to create new users without 
proper approvals and both department and contracted staff with the ability to access, 
enter, and update data. Additionally, according to best practices, contracted staff 
should not have access to the production environment. 


CE ES 


35 


36 | Montana Legislative Audit Division Legislative Audit Division 


While the department recognizes the importance of restricting access, management 
indicated it utilized the roles that were already in the system. However, management 
also indicated those roles can be customized. Since unrestricted access can affect data 
integrity, we believe the department should strengthen its controls over its application 
roles to ensure only authorized individuals can accomplish higher level tasks. 


RECOMMENDATION #9 


We recommend the Department of Public Health and Human Services: 


A. Create application roles that limit permissions assigned to only those 
required for the specific position. 


B. Limit contractor access to production data. 


TT 


Privileged User Activity Should Be Monitored 


Another way the quality of data in a computer system can be protected is by monitoring 
its use by those with privileged roles. Specifically, best practices indicate the following 
controls related to system monitoring: 


¢ ‘The computer system should audit the execution of privileged functions, and 
the organization should review and analyze those system audit records. 


¢ The organization should monitor the use of information system accounts, 
and the monitoring should include looking for, and reporting, accounts with 
atypical use. 


¢ ‘The organization should develop a continuous monitoring strategy and 
implement a continuous monitoring program. 


The system has the capacity to track user activity, but there is currently no review of 
the information. As discussed above, there are 34 users with administrative rights that 
use these roles in everyday operations. Misuse of these capabilities within the system 
could easily go unnoticed if review of user activity is not done. Currently users with 
the ability to manipulate data and system settings could change information in the 
immunization registry without management and/or other department staff knowing. 


Additionally, some imMTrax users, such as lead public health nurses, are allowed 
access to personal health information in emergency situations such as during a disease 
outbreak. However, they are currently using this high level of access on an on-going 
basis. Potentially, users could inappropriately use their access to change and/or modify 
immunization registry data. While the department indicated the access was set-up this 
way initially to allow for quick use in emergency situations and they have concerns 


regarding requiring two log-ins for these individuals, they are considering a plan 
to consistently monitor the use of those accounts. Given the sensitive nature of the 
information in the registry, it is particularly important that those with high level access 
to it should be monitored. 


Ne 


RECOMMENDATION #10 





We recommend the Department of Public Health and Human Services 
develop and implement documented procedures for monitoring activity of 
users with privileged roles. 
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Appendix A 


Appendix A appears on the next two pages and includes details on the Advisory 
Committee on Immunization Practices (ACIP) recommendations to protect children 
against 14 vaccine preventable diseases. It is published annually on the Centers for 
Disease Control and Prevention’s (CDC’s) web site. 
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May 2, 2014 LEGISLATIVE AUsre 4 Vv. 
Sarah A. Carlson 

Legislative Auditor 

Office of the Legislative Auditor 

State Capitol, Room 160 

Helena MT 59620-1705 


Re: Childhood immunization Requirements in Montana 
Dear Ms. Carlson: 


The Department of Public Health and Human Services has reviewed the Childhood Immunization 
Requirements in Montana audit (13P-07) completed by the Legislative Audit Division. Our responses and 
corrective action plans for each recommendation are provided below. 


Recommendation #1a: We recommend the Department of Public Health and Human Services: Propose 
rule changes and seek legislation to align Montana’s child care, preschool, and school immunization 
requirements with the Advisory Committee on Immunization Practices Recommendations. 


Response: Concur 


Corrective Action: The department is in the process of drafting updated immunization rules for 
child care facilities. The revised rules will more closely align with recommendations of the 
Advisory Committee on Immunization Practices (ACIP) and add Hepatitis B and pneumococcal 
vaccine as required immunizations. While the addition of other recommended vaccines was 
considered, the decision was made to limit the additions to the vaccines most commonly 
required in other states. 


In addition, the department is currently reviewing legislative proposals in preparation for the 
2015 session. Proposals under consideration include updating school immunization 
requirements in statute or proposing rulemaking authority be given to the department to 
simplify updating as national recommendations change. Specifically, adding requirements for 
the varicella series and a pertussis booster for school-aged children is anticipated. 


Planned Completion Date: We anticipate the revised rules will be in place by fall of 2014. 
Potential statute changes may be considered during the 2015 legislative session. 


Recommendation #1b: We recommend the Department of Public Health and Human Services: Establish 
a process to regularly determine if changes are needed to immunization requirements. 


Response: Concur 


Corrective Action: None required. Review of department administrative rules occurs at least 
every other year in accordance with the Montana Administrative Procedures Act, 2-4-314 MCA. 


In the specific case of rules related to immunizations, ARMs have received frequent review as 
the agency has been improving processes at the state and local level, responding to, or 
proposing, legislation and determining the most effective means of promoting vaccination 
efforts. The results of our efforts are reflected in our response to recommendation #1a outlining 
recent efforts in this area. 


Planned Completion Date: Already in place 


Recommendation #2; We recommend the Department of Public Health and Human Services develop 
and implement a documented process to ensure preschool attendee compliance with immunization 
requirements. 


Response: Concur 


Corrective Action: The department will continue our efforts to identify preschools and monitor 
compliance with immunization requirements outlined in statute and rule. As indicated during 
the audit review, no list of preschools is maintained by the Office of Public Instruction (OPI) or 
other state agency making this effort difficult. However, many sites identifying themselves as 
preschools are licensed or registered child care facilities and are reviewed by the department. At 
the present time, the department's list of licensed or registered child care facilities includes 44 
sites with “preschool” in their title and all are eligible for review of immunization records. To 
supplement this effort, immunization contracts with local public health agencies will be revised 
in 2015 to request assistance with identifying and assessing preschools, if any, that are not 
presently licensed or registered as a child care facility. 


Planned Completion Date: Revisions to the immunization contracts will be effective January 1, 
2015. 


Recommendation #3a: We recommend the Department of Public Health and Human Services: Expand 
contract provisions with the local health department to follow up on children reported as noncompliant 
or conditionally attending. 


Response: Concur 


Corrective Action: Department contracts and procedures issued in 2015 will be modified to 
improve documentation of outcomes of any child determined as noncompliant (not up to date) 
during an immunization review. Department immunization staff will work closely with staff of 
the Quality Assurance Division (QAD) to implement and promote a consistent approach to 
exclusion and documentation. 


Children conditionally attending are technically in compliance and public health authorities may 
or may not be directly involved in each case. However, when attendees with conditional 
approvals are found during review, processes for additional follow-up will be developed and 
implemented during the 2015 contract period. 


Planned Completion Date: Revisions to the immunization contracts will be effective January 1, 
2015. 
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Recommendation #3b: We recommend the Department of Public Health and Human Services: Follow up 
with local health departments to ensure exclusions occur in compliance with immunization 
requirements. 


Response: Concur 


Corrective Action: None required. Department policies regarding exclusions have been 
developed and shared with all local public health jurisdictions and related trainings have, and 
will continue to be, conducted. In addition, many public health jurisdictions have exercised their 
local powers to exclude children not in compliance with administrative rules, in some cases 
going beyond department guidance. The department is confident that appropriate exclusions 
are occurring and efforts to improve overall documentation of child care immunization reviews 
in 2015 will provide more information exclusions that occur. 


Planned Completion Date: Already in place 


Recommendation #4: We recommend the Department of Public Health and Human Services strengthen 
its annual child care assessment selection process to ensure all facilities are consistently assessed. 


Response: Concur 


Corrective Action: The department works closely with local public health jurisdictions to assess 
compliance with immunization requirements in child care settings. Licensed centers, currently 
numbering 260, are reviewed annually in accordance with 52-2-733 MCA. The same statute 
requires 20% of the 825 registered facilities to be reviewed annually. State surveyors from QAD 
conduct the visits and perform inspections and immunization reviews in registered child care 
facilities. While state surveyors inspect licensed facilities, immunization reviews in these 
facilities are conducted by local health agencies. The department’s immunization contracts with 
local public health jurisdictions were intended to supplement this process and ensure more 
frequent reviews of 825 registered facilities and better document reviews of the 260 licensed 
facilities. As a result, the department maintains that the current level of reviews is more than 
adequate and exceeds the oversight required by the statute. 


However, the department does see the need to improve documentation of the processes and 
more frequent state-level review of inspections performed to ensure immunization audits occur 
as intended. To accomplish this task, the department will adapt the electronic system utilized by 
schools to capture, document and share information related to child care reviews. We anticipate 
implementing this system at the beginning of the 2015 contract period. 


Planned Completion Date: Revisions to the immunization contracts will be effective January 1, 
2015. . 


Recommendation #5a: We recommend the Department of Public Health and Human Services: Develop 
formalized policy and procedures regarding the compilation and verification of school reports. 


Response: Concur 


Corrective Action: Annual review and submission of information related to school immunization 
coverage levels is required by rule. Since implementation of electronic submittal of this 
information three years ago, we have a 92 to 95 percent compliance rate from the state’s 824 
(2013-14 Office of Public Instruction (OPI) listing) schools on our list. Policies and procedures for 
the submission of reports are in place; however, verification of the information submitted by 
schools is not currently conducted. 


The department will work with local public health jurisdictions and program staff to develop a 
sampling approach to verify accuracy of reports. The focus of this effort will be restricted to 
kindergartens and rd grade- key populations tracked at the federal level. Reviews will be 
documented and significant discrepancies may result in additional reviews and training of 
relevant staff. These efforts will be in place at the beginning of the 2014-15 school year. 


Planned Completion Date: A system to verify a sample of selected grades will be implemented 
at the beginning of the 2014-15 school year 


Recommendation #5b: We recommend the Department of Public Health and Human Services: Develop 
a documented process to actively monitor school attendee compliance with immunization 
requirements. 


Response: Do not concur 


Corrective Action: None. As stated in our response to recommendation #5a, administrative rules 
of the department require schools to submit annual reports regarding immunization of pupils. 
Reports are to be reviewed at the state and local level and actions taken if concerns are 
identified. The position of the department is that this approach is sufficient and consistent with 
statute. Statutes 20-5-403 through 408 MCA are clear that enforcement is the responsibility of 
each school. However, department communications with schools and local public health 
agencies prior to the 2014-15 school year will provide guidance on compliance issues and 
improving review of, and response to, school immunization reports at the local public health 
level. 


Recommendation #6a: We recommend the Department of Public Health and Human Services develop a 
documented process to: Notify schools about the requirements of ARM 37.114.721. 


Response: Concur 


Corrective Action: The department communicates with all schools at the beginning of each 
school year regarding immunization reporting requirements. Education regarding ARM 
37.114.721 requiring reporting of exclusions lasting 3 days or more to state and local public 
health will be provided. The department will provide guidance to local public health agencies 
regarding this rule and suggest steps they may take to address the issue. Communications and 
guidance regarding this will be disseminated to school administrators and public health officials 
at the beginning of the 2014-15 school year. 


Planned Completion Date: Information regarding compliance with the above rule will be 
disseminated in September of the 2014-15 school year. 


Recommendation #6b: We recommend the Department of Public Health and Human Services develop a 
documented process to: Track students excluded from failing to meet the requirements of a conditional 
enrollment. 


Response: Concur 


Corrective Action: Information submitted in response to ARM 37.114.721 requiring reporting of 
exclusions in schools lasting 3 days or more will be systematically documented at the state level. 
This will be implemented at the beginning of the 2014-15 school year. 


Planned Completion Date: A system to track excluded students will be in place at the beginning 
of the 2014-15 school year. 


Recommendation #7: We recommend the Department of Public Health and Human Services seek 
legislation providing guidance on the use of the state’s immunization registry. 


Response: Concur 


Corrective Action: The department is currently reviewing options to address a number of 
immunization related issues, including simplifying use of the state’s immunization information 
system (IIS). Specifically, implementing an approach that would include all vaccine recipients 
unless they have chosen to opt-out is being considered. Opt-out approaches allow for more 
efficient operations at the patient, provider and state level while still allowing personal choice. 
At the present time, Montana is one of three states with an opt-in approach which adds cost 
and complexity to the operation of local and state systems. 


Planned Completion Date: Potential legislation may be prepared during the 2015 legislative 
session. Final results are legislature dependent. 


Recommendation #8a: We recommend the Department of Public Health and Human Services: Develop 
written procedures and mappings for data flow into the immunization registry. 


Response: Concur 

Corrective Action: None required. Documentation regarding mapping of data elements in the IIS 
have been developed and distributed. At the present time 25 facilities are submitting data 
electronically to the IIS- each following the data formats specified by the department’s 
immunization program. Additional sites are in the planning or testing process. In addition to 
electronic transfer, IIS documentation details hand entry of data as well 


Planned Completion Date: Already in place 


Recommendation #8b: We recommend the Department of Public Health and Human Services: 
Determine what validations are applied to the data and document the findings. 


Response: Concur 
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Corrective Action: The IIS acquired by the department is based on architecture that was 
originally developed in Wisconsin and modified by other states as immunization 
recommendations and methods of data transfer evolved. The department acknowledges that 
certain algorithms used by the software lack detailed documentation. The department is 
committed to continuing our efforts to work with the assistance of our vendor to document 
details of the algorithm. 


Planned Completion Date: This is an ongoing process and no specific time frame has been 
developed. 


Recommendation #9a: We recommend the Department of Public Health and Human Services: Create 
applications roles that limit permissions assigned to only those required for the specific position. 


Response: Concur 

Corrective Action: The department has reviewed the 34 accounts identified by the audit and has 
been able to reduce the number to 24 accounts necessary for operations. Many of the extra 
accounts were used for testing purposes or one-time events and were no longer necessary. 
Existing accounts will be reviewed at least twice annually to ensure that any account no longer 
needed is deleted from the system. 


Planned Completion Date: Already in place 


Recommendation #9b: We recommend the Department of Public Health and Human Services: Limit 
contractor access to production data. 


Response: Concur 

Corrective Action: None required. The department’s contractor is essential to operation of the 
IIS and access is already limited to essential staff. The department will continue to monitor 
access as part of our biannual review process and continue to ensure only essential staff have 
access to production data. 


Planned Completion Date: Already in place 


Recommendation #10: We recommend the Department of Public Health and Human Services develop 
and implement documented procedures for monitoring activity of users with privileged roles. 


Response: Concur 


Corrective Action: Procedures will be developed and reviewed with users with privileged roles 
regarding system use. However, at the present time the vast majority of users, including 
privileged users, can change patient data and such abilities are a must for function of the 
registry. It is important to note that average and privileged users cannot change tables or other 
items involved in set-up of the registry. Privileged users can view more detailed patient 
information. Such access is necessary during public health events to determine who may be at 
risk or protected when a vaccine preventable disease is involved. 


Planned Completion Date: Anticipated to be developed and distributed by June 30", 2014. 
Thank you for the detailed examination of our immunization efforts and the valuable insight. 
Sincerely, 


Richard H. Opper 
Director 


cc: Marie Matthews, Operations Services Branch Manager 
Becky Schlauch, Business and Financial Services Division Administrator 
Jim Murphy, Communicable Disease Control & Prevention Bureau Chief 


